With the rapid increase in the number of consumers having access to the World Wide Web, a corresponding need for conducting commerce over the Internet has emerged. However, concerns with online security have undermined the evolution of electronic commerce as security issues have affected the required level of trust between online retailers and consumers. In traditional business transactions, trust is established face-to-face and supported by documentation that reduces liability. Today, traditional business transactions are being transformed. In particular, the use of smart cards is expanding, further affecting the level of trust retailers and consumers have in electronic commerce.
A smart card, also called a chip card, integrated circuit card, memory card or processor card, is typically a credit card-sized plastic card that includes one or more integrated circuits. A smart card can interface with a point-of-sale terminal, an ATM, or with a card reader integrated with a computer, telephone, vending machine, or a variety of other devices. A smart card may be programmed with various types of functionality such as stored-value applications, credit or debit applications, loyalty applications, cardholder information, etc. Although a plastic card is currently the medium of choice for smart cards, it is possible to implement these cards using a smaller form factor. For example, a smart card could be attached to a key chain or it could be as small as a single integrated circuit chip. A smart card may also be implemented as part of a personal digital assistant, telephone, or some other form.
Typically, to increase user trust, a smart card contains a hardware encryption module for performing a variety of encryption algorithms. Encryption may also be performed in software. A typical process for issuing smart cards and for reconciling transactions performed with these cards in the consumer context may be described as follows. A terminal supplier builds the equipment used by a service provider to provide goods and/or services to consumers via smart card and service payment terminal. A card supplier contracts with an integrated circuit manufacturer and a card manufacturer for integrated circuits and plastic card bodies, respectively. The card supplier then embeds the integrated circuits in the cards and initializes them with a serial number. The card supplier then delivers these cards to a card issuer. In conjunction with a clearing and administration system, the card issuer personalizes new cards and then transfers these cards to individual cardholders (i.e. consumers). A cardholder may then charge the card with value prior to use. Alternatively, the card may be delivered with value pre-loaded. The cardholder may then use the card at a service payment terminal to purchase goods and/or services from the service provider. Upon purchase, the terminal debits the value of the purchase from the card, thus creating a service payment. The system may be implemented, for example, using Visa, MasterCard, American Express, Discovery, Players Card International, bank and financial institution debit cards, and other cards.
In this typical process, all transactions are sent in a data file from the service payment terminal, via an acquirer, to a clearing and administration system. Accumulated service payment batches from other terminals are also sent to the clearing and administration system. Based upon this collection data, the clearing and administration system receives money from the card issuer. The money received from the card issuer, of course, originates from the cardholder. The clearing and administration system then transfers a lump sum to the acquirer using a suitable settlement service (e.g. Visa, MasterCard American Express, Discovery, Players Card International, etc.) to pay the various service providers having a relationship with the acquirer. Based upon the collection data, the acquirer then transfers an appropriate amount of money to each service provider reflecting the value of the goods and services that that service provider provided to cardholders that period (e.g. day). The value of the goods and services provided is based on deductions from cardholders' smart cards.
A consumer typically uses a service payment terminal in a face-to-face context in order to purchase goods at a store or directly from the terminal itself. The service payment terminal can be an attended device or it can be integrated into a self-service device such as a vending machine or public telephone. For example, the service payment terminal may be incorporated into a soda machine in order to dispense sodas to a customer where the customer pays by inserting a smart card. Or, the service payment terminal may be a point-of-sale (POS) terminal typically found at the check-out counter or a store.
In general, service payment terminals allow consumers to use smart cards for the payment of goods and services. A service payment terminal generates a payment result from a transaction and bundles individual payment results into a collection for transfer to a clearing and administration system. The service payment terminal then transfers funds debited from consumers' smart card to the merchant whose goods and services were purchased through the terminal. Thus, a variety of goods and services may be purchased using a smart card from a merchant having a service payment terminal on premises. In addition, a consumer with a smart card may purchase goods or services from a merchant over the Internet.
Now, in order to purchase a product or service with a smart card, the card must first be loaded with value or with an identity. Typically, “stored-value” cards are loaded with value while “debit” and “credit” smart cards are loaded with the identity of the card holder. With respect to stored-value cards, value can be loaded onto the card in a variety of ways. For example, while inconvenient for the consumer, the consumer may physically travel to a bank or other institution that has an automated teller machine (ATM), or other similar device, in order to load value onto the smart card. With respect to loading value onto a smart card, the consumer may insert money into a value loading machine and have a corresponding value loaded onto the card. Or, the consumer may use a debit card to deduct value from the consumer's bank account for transfer to the card. Additionally, a credit card can be used as the source of value. In these examples, the consumer must travel to the bank to load value. A further inconvenience exists in that not all banks have value loading machines. To overcome this inconvenience, a method by which consumers may load value onto their smart cards via the Internet has been proposed and is described in U.S. patent application Ser. No. 09/070,488 (Davis, et al.), filed Apr. 30, 1998, and entitled “Internet Loading System Using Smart Card”, which is incorporated herein by reference.
One disadvantage of current smart card systems is that they are dependent on the use of two hardware components new to the mass consumer market: smart cards and smart card readers. Without having large numbers of smart cards and card readers in use, there is little demand for them from consumers, which in turn makes it difficult to convince merchants to adopt these systems.
A need therefore exists for an electronic commerce system that does not require the prior deployment of physical smart cards and smart card readers. Such a system would allow merchants and issuers to establish a market presence that would in turn facilitate the acceptance of physical smart cards and card readers as they become more widely available.
With respect to the issue of trust, for electronic commerce, trust must be established in seconds between strangers who are physically separated. Effective security is based on the unequivocal authentication of authorized parties.
Methods for providing authentication include digital signatures, the public key infrastructure (PKI), and electronic payment policies such as X9.59. However, the traditional digital signature model is a complex and computationally expensive process when applied to mainstream business transactions over the Internet. The traditional digital signature model was not developed specifically for today's business transactions or a secure means to conduct electronic commerce that takes into account the infrastructure and business processes already in place within the financial sector to ensure trust in financial transactions. On the other hand, the PKI model does provide strong authentication. In addition, the financial industry's X9.59 policy, is a light-weight, high integrity, strong authentication payment protocol targeted for all methods of electronic payment including, but not limited to, set-top boxes, point-of-sale terminals with online authorization, and merchant web servers. With the appropriate smart card, X9.59 can work at point-of-sale, even improving the integrity of the current POS infrastructure, while eliminating the necessity for any identity information in payment transactions.
A need therefore exists for an electronic commerce system with effective authentication suitable for today's business transactions.
Finally, in addition to being secure, modern electronic commerce systems must protect individual privacy without impeding legitimate inquiries by law enforcement and government agencies. Typically, to improve privacy, a modem electronic commerce system must be relatively anonymous for the user.
In summary, smart cards require information be recorded on them. In the case of stored-value cards, a monetary value must be downloaded to the card. In the case of a debit or credit cards, an identity must be securely transferred to the card. Hence, a need exists for an electronic commerce system that has effective online authentication and that includes the benefits of physical smart card but that operates in a virtual environment. In addition, a need exists for an electronic commerce system that provides the benefits of card-present transactions in the context of remote networks and the Internet. Furthermore, a need exists for an electronic commerce system that can reduce costs associated with current systems with respect to card distribution, reader distribution, and connectivity. Moreover, a need exists for an electronic commerce system that provides effective authentication, security, and privacy.
A need therefore exists for an improved electronic commerce system. Consequently, it is an object of the present invention to obviate or mitigate at least some of the above-mentioned disadvantages.